diff --git a/.buildkite/default.nix b/.buildkite/default.nix
index 514fbd3..587e5fd 100644
--- a/.buildkite/default.nix
+++ b/.buildkite/default.nix
@@ -11,13 +11,19 @@ let
   libs = ps: with ps; [turtle safe transformers extra async];
   ghc' = haskellPackages.ghcWithPackages libs;
 
+  # Include the stack nix-shell in closure of stackRebuild, so that it
+  # doesn't get garbage-collected whilst the build is running.
+  # https://github.com/commercialhaskell/stack/issues/3479
+  stackShell = import ../nix/stack-shell.nix {};
+
   stackRebuild = runCommand "stack-rebuild" {
     buildInputs = [ ghc' makeWrapper ];
   } ''
     mkdir -p $out/bin
     ghc -Wall -threaded -o $out/bin/rebuild ${./rebuild.hs}
     wrapProgram $out/bin/rebuild \
-      --set PATH "${lib.makeBinPath buildTools}"
+      --set PATH "${lib.makeBinPath buildTools}" \
+      --set NO_GC_STACK_SHELL ${stackShell}
   '';
 
 in
diff --git a/nix/cabal-shell.nix b/nix/cabal-shell.nix
new file mode 100644
index 0000000..e15b784
--- /dev/null
+++ b/nix/cabal-shell.nix
@@ -0,0 +1,58 @@
+# This shell file provides a compiler, build tools and system
+# libraries, and lets Cabal build all of the Haskell package
+# dependencies.
+#
+# The default shell (../shell.nix) uses the Haskell.nix shellFor to
+# also provide Haskell package dependencies in the shell environment.
+
+{ pkgs ? import ./default.nix {}
+# optional string argument to override compiler, e.g.
+#   nix-shell nix/cabal-shell.nix --argstr compiler ghc8102
+, compiler ? null
+}:
+
+with pkgs;
+
+mkShell rec {
+  name = "offchain-metadata-tools-cabal-env";
+  meta.platforms = lib.platforms.unix;
+
+  ghc = if (compiler == null)
+    then offchainMetadataToolsHaskellPackages.metadata-lib.project.pkg-set.config.ghc.package
+    else haskell-nix.compiler.${compiler};
+
+  tools = [
+    ghc
+    cabal-install
+    nix
+    pkgconfig
+  ]
+  ++ lib.optional (!stdenv.isDarwin) git;
+
+  libs = [
+    zlib
+    gmp
+    ncurses
+    lzma
+    openssl
+    libsodium
+  ]
+  ++ lib.optional (stdenv.hostPlatform.libc == "glibc") glibcLocales
+  ++ lib.optional stdenv.isLinux systemd.dev
+  ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    Cocoa CoreServices libcxx libiconv
+  ]);
+
+  buildInputs = tools ++ libs;
+
+  # allow building the shell so that it can be cached in hydra
+  phases = ["nobuildPhase"];
+  nobuildPhase = "echo '${lib.concatStringsSep "\n" buildInputs}' > $out";
+  preferLocalBuild = true;
+
+  # Ensure that libz.so and other libraries are available to TH splices.
+  LD_LIBRARY_PATH = lib.makeLibraryPath libs;
+
+  # Force a UTF-8 locale because many Haskell programs and tests assume this.
+  LANG = "en_US.UTF-8";
+}
diff --git a/nix/stack-shell.nix b/nix/stack-shell.nix
new file mode 100644
index 0000000..3281bd9
--- /dev/null
+++ b/nix/stack-shell.nix
@@ -0,0 +1,20 @@
+# This is the derivation used by "stack --nix".
+# It provides the system dependencies required for a stack build.
+{ pkgs ? import ./default.nix {}
+}:
+
+let
+  cabalShell = import ./cabal-shell.nix {
+    inherit pkgs;
+  };
+in
+  cabalShell.overrideAttrs (old: {
+    name = "offchain-metadata-tools-stack-env";
+
+    buildInputs = old.buildInputs ++ [ pkgs.stack ];
+
+    # Build environment setup copied from
+    # <nixpkgs/pkgs/development/haskell-modules/generic-stack-builder.nix>
+    GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    STACK_IN_NIX_SHELL = "true";
+  })